Prominent Ransomware Negotiator Faces Extortion Charges
Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.
Actualizado hace 1 min
Noticias de ciberseguridad
Alertas de vulnerabilidades explotadas, exploits y pruebas de concepto, malware, ransomware e incidentes con contenido técnico, de los medios de ciberseguridad en castellano. Se actualiza solo durante todo el día.
656 notas en castellano e inglés. Quitar filtros
Ciberseguridad
No Identity, No Recovery: Cyber Resilience Starts With IAM
The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink.
Filtraciones de datosExploits y PoC
12th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited…
Ciberseguridad
Passing the Baton: Dark Reading Names New Editor-in-Chief
Fahmida Y. Rashid will keep the momentum going as she leads Dark Reading.
Ekoparty 22: Hacking in the age of AI after Mythos, Fable, Sol and Astra.
Hoy que es festivo en España, aprovecho para dejaros rápidamente la charla que di en la Ekoparty 22 titulada "Hacking in the age of AI after Mythos, Fable, Sol and Astra.", para que si tenéis algo de tiempo y queréis invertir estos 45 minutos en ver lo que conté - y cómo lo…
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs.Paper!…
ARTEX y el salto de los agentes ofensivos: cuando el harness importa mas que el modelo
Durante años, la conversación sobre IA ofensiva se concentró en una pregunta casi infantil: "qué modelo sabe más hacking". La campaña observada contra entidades financieras de Corea del Sur a finales de septiembre y comienzos de octubre de 2026 obliga a cambiar esa pregunta. El…
110 vulnerabilidades parcheadas en dispositivos Google Pixel | Blog oficial de Kaspersky
Por qué Google Pixel obtiene sus propias actualizaciones de seguridad, qué vulnerabilidades corrigen y qué fallos solucionó Google en septiembre de 2026.
Making sure the checks get printed
Pierre's debut newsletter explores the messy, real-world side of risk management and how to keep vital systems running when a perfect patch isn't an option.
Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn
Day Three of Pwn2Own Ireland 2026 wrapsup with 17 attempts scheduled, roughly $1.33 million on the board.The headliner is the Google Pixel 10, which draws three separate attempts: Xint at 11:15 AM, Ikotas Labs at 2:00 PM, and the Valsamaras/Ken Gannon (Djini.ai)/Valsamara team…
Phishing e ingeniería socialIA y seguridad
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions.
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis.
Ciberseguridad
¿Cuánto vales para un ciberdelincuente? Anatomía económica de una identidad robada
Hay una pregunta que probablemente nunca nos hemos hecho cuando introducimos nuestros datos en una web, rellenamos un formulario, enviamos una fotografía del DNI o pagamos con tarjeta: ¿Cuánto valen esos datos una vez dejan de pertenecernos? La respuesta resulta bastante menos…
Ciberataques y APTFiltraciones de datos
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments
VulnerabilidadesHerramientas e investigación
Microsoft, Adobe, Apple, and Foxit vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft.The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s third-party vulnerability…
CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products
OverviewOn October 5, 2026, Atlassian published a security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo…
Ciberseguridad
The ASOS Incident: When Attackers Use the Channels Customers Trust
This week, ASOS customers opened their phones to find a hostile push notification delivered through the retailer’s own app. The message claimed the company’s Snowflake environment had been compromised and directed ASOS to engage with the sender through Telegram. ASOS later…
Filtraciones de datosIA y seguridad
One breach, please, and make no mistakes
The cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure. How you prepare for agentic threats is what makes the difference during real incidents.
Pwn2Own Ireland 2026 - Day Two Results
Day Two of Pwn2Own Ireland 2026 has 24 attempts on the docket, with roughly $780,000 up for grabs, running 9:30 AM to 7:30 PM IST.Samsung's Galaxy S26 will be attempted three separate times — by Valsamaras/Ken Gannon (using Djini.ai)/Valsamara at 1:00 PM, Kyeongmin Kim at 3:15…
Ciberseguridad
The model isn't cooperating
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In this post, I'll briefly explore this phenomenon, the
You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
Welcome back to yet another episode of "security was taken seriously".Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we keep on watching security best practices crumble behind “secure by design”
MalwareHerramientas e investigación
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.
Ciberseguridad
Pwn2Own Ireland 2026 - Day One Results
Welcome to Day One of Pwn2Own Ireland 2026! Today, 21 entries took the Pwn2Own stage to target multiple categories - including multiple Samsung attempts and our first Pixel entry.Follow the action live! We’ll be posting real-time updates and results throughout the competition on…
How to fix a bug in a fix
Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure. Some vendors express concern about potential scenarios in which they are unable to fix vulnerabilities that are causing…